Toysrus.com, New Jersey Settle Privacy Investigation

The State of New Jerseys Division of Consumer Affairs announced on Thursday that it has reached agreement with Toysrus.com to settle a state investigation into the Web sites privacy policies.

Admitting no liability or wrongdoing, Toysrus.com agreed to clarify its posted privacy policy, provide “clear and conspicuous links” to that policy, and to pay New Jersey $50,000 for “programs designed to inform the public about issues relating to privacy on the Internet.”

According to Beth Rosenberg, a spokeswoman for the New Jersey Division of Consumer Affairs, the investigation into Toysrus.coms privacy policies, which began last year, was not generated by any consumer complaints, but from within the Division of Consumer Affairs itself. The states concerns touched on “potentially confusing language” on the Toysrus.com Web site.

Last summer, however, Toysrus.com did come under attack from privacy advocates and class-action lawsuits launched in New Jersey, Texas and California, for sharing consumer information with Coremetrics, Inc., a San Francisco, Ca. firm that analyzes online customer behavior, which, the privacy advocates charged, violated Toysrus.coms stated privacy policy.

Toysrus.com and Coremetrics denied the charges, saying that Coremetrics was effectively a subcontractor, analyzing online behavior to improve Toysrus.coms customer shopping experience. Coremetrics told the Bergen Record that criticism of its practices was based “on the erroneous assumption that Coremetrics collects data across multiple sites with the intention of reselling it to third parties.”

The Toysrus.com privacy policy currently states that the company “may also utilize a service provider to assist us in aggregating guest information. We may then share such aggregate information with prospective partners and advertisers. This aggregate information does not contain any information that could identify an individual guest. We may also disclose specific guest information when we believe that such disclosure is necessary to comply with the law or to protect the interests or safety of Toysrus.com, Imaginarium.com, their guests, and others. We do not sell or rent personally identifiable information.”

The full privacy policy is found here.

“We are pleased Toysrus.com has fully cooperated with the State in addressing Internet privacy issues. New Jerseys online consumers have a right to know if their personal information is being distributed to a third party,” said New Jersey State Attorney General John J. Farmer, Jr. in a prepared statement.

Rosenberg said the New Jersey Division of Consumer Affairs possessed no evidence that Toysrus.com was selling information to third parties.

“Companies must post easy-to-understand privacy policies on their Web sites and stand by these policies,” said Mark S. Herr, the director of the New Jerseys Division of Consumer Affairs, in a prepared statement. “If they dont, they risk violating [New Jerseys] Consumer Fraud Act and the State will not hesitate to pursue these companies and take the appropriate legal action.”

The Consumer Fraud Act protects consumers against what the law calls “unconscionable commercial practices.” It is, said Rosenberg, “kind of a far-sweeping law, basically saying you cant give misinformation, you cant mis-advertise or we can fine you, or sue you.”

“This is a message to anyone who operates a Web site, privacy had better be a very, very important part of the business” said Jeanne Meyer, Vice President of Corporate Communications for Toysrus.com. “Thats why were happy with this agreement. Were happy to have had the opportunity to have someone take a look at our policy. And by signing this agreement, it ends the investigation, and we can move forward.”

Toysrus.com, located in Fort Lee, New Jersey, is a privately held subsidiary of Toys “R” Us, Inc.

The Division of Consumer Affairs informational programs on Internet privacy issues “have yet to be developed” said Rosenberg.